CVE-2019-9516

원문 설명

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

영향받는 소프트웨어

• nginx ≥ 1.9.5 < 1.16.1≥ 1.17.0 ≤ 1.17.2 수정 버전: 1.16.1 정확 일치

상세

공개일

2019-08-14

최종 수정

2024-08-05

CVSS 벡터

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400

EPSS(30일 내 악용 확률)

57.46% (백분위 99)

참고 자료

• cve.org/CVE-2019-9516
• nvd.nist.gov/vuln/detail/CVE-2019-9516
• kb.cert.org/vuls/id/605641/
• github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
• seclists.org/bugtraq/2019/Aug/24
• usn.ubuntu.com/4099-1/
• seclists.org/fulldisclosure/2019/Aug/16
• www.synology.com/security/advisory/Synology_SA_19_33
• support.f5.com/csp/article/K02591030
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T...
• seclists.org/bugtraq/2019/Aug/40
• www.debian.org/security/2019/dsa-4505
• security.netapp.com/advisory/ntap-20190823-0002/
• security.netapp.com/advisory/ntap-20190823-0005/